219 matches found
Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8 On require of the package's main entry index.js, polyfill.js downloads a platform-specific binary from one of several hosts whose names are...
MAL-2026-12036 Malicious code in bigops-chat-tmsg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4 On require of bigops-chat-tmsg, index.js silently loads runtime.js via a swallowed try/require appended after an empty stub class exposing...
MAL-2026-11550 Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...
PT-2026-66471
The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized keys file for the root user. An attacker in possession of the...
Malicious code in parallely (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a862cdceb2998828aba8de0d4a672b86a2c22dff073356e5acd89e894aced56 The npm package name parallely typosquats concurrently: package.json advertises the concurrently repository, author, and funding while shipping...
MAL-2026-11143 Malicious code in parallely (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a862cdceb2998828aba8de0d4a672b86a2c22dff073356e5acd89e894aced56 The npm package name parallely typosquats concurrently: package.json advertises the concurrently repository, author, and funding while shipping...
MAL-2026-10535 Malicious code in my-empty-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914ffc98ce1f6553e4f9655208318800d0d22663842eb4c9a3d0d51d4f143bdd package.json declares postinstall: node index.js. On npm install, index.js branches on os.platform and executes platform-specific shell commands:...
Malicious code in llama-tokenizer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22305b1026f27be6d5b78dc19f7db7a05cc9d1818b7ebc7cda0fce92431aa02 This package typosquats llama-tokenizer-js. On require, index.js reconstructs a host and URL path from String.fromCharCode numeric arrays, downloads ...
Malicious code in @help-forms/application-aff (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5ab5493acb5b3ffcab7f80dbdf34e1485bbe5d5d03978949199cdabf6f676a @help-forms/[email protected] ships a heavily obfuscated postinstall script scripts/postinstall.js, obfuscator.io fingerprints: rotated string...
MAL-2026-6494 Malicious code in @help-forms/application-aff (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5ab5493acb5b3ffcab7f80dbdf34e1485bbe5d5d03978949199cdabf6f676a @help-forms/[email protected] ships a heavily obfuscated postinstall script scripts/postinstall.js, obfuscator.io fingerprints: rotated string...
Malicious code in @emcd-vue/auth (npm)
Part of a coordinated multi-package supply-chain attack impersonating EMCD emcd.io, a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the @emcd-vue npm scope to pose as an internal Vue.js front-end tooling package from "EMCD Platform Engineering." The package...
MAL-2026-5163 Malicious code in @emcd-vue/auth (npm)
Part of a coordinated multi-package supply-chain attack impersonating EMCD emcd.io, a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the @emcd-vue npm scope to pose as an internal Vue.js front-end tooling package from "EMCD Platform Engineering." The package...
MAL-2026-4468 Malicious code in @wengine-ai/claude-code-router-shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e362000d036139e02a066a82ec157314a07796e0e855cdce184cc081ca4591 dist/index.js line 14 issues a fetch call to https://pub-0dc3e1677e894f07bbea11b17a29e032.r2.dev, an anonymous Cloudflare R2 bucket, and references...
PT-2026-41959
Name of the Vulnerable Software and Affected Versions go-git versions prior to v5 Description A path validation issue allows crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. This occurs because the software drifted from...
Malicious code in typography-stylecss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eeb50f69746fd21696baaa7d3534bbd22489edb037742ca591d49ca88981f70 The package impersonates the legitimate @tailwindcss/typography plugin: README, src/index.js, src/utils.js, and src/styles.js are copied verbatim fro...
Toward Autonomous SOC Operations: End-To-End LLM Framework for Threat Detection, Query Generation, and Resolution in Security Operations
Security Operations Centers SOCs face mounting operational challenges. These challenges come from increasing threat volumes, heterogeneous SIEM platforms, and time-consuming manual triage workflows. We present an end-to-end threat management framework that integrates ensemble-based detection,...
GHSA-8793-7XV6-82CF ImageMagick has an Out-of-bounds Write via InterpretImageFilename
Due to an incorrect return value on certain platforms a pointer is incremented past the end of a buffer that is on the stack and that could result in an out of bounds write. ================================================================= ==48558==ERROR: AddressSanitizer: stack-buffer-overflow o...
Automatic Attack Script Generation: A MDA Approach
It is widely recognized that practical exercises are crucial for teaching cybersecurity in higher education. However, their setup is not only expensive, time-consuming, and prone to numerous errors, but also requires technical and programming skills to create attack contexts and scripts. To...
SynRAG: A Large Language Model Framework for Executable Query Generation in Heterogeneous SIEM System
Security Information and Event Management SIEM systems are essential for large enterprises to monitor their IT infrastructure by ingesting and analyzing millions of logs and events daily. Security Operations Center SOC analysts are tasked with monitoring and analyzing this vast data to identify...
CVE-2025-4106 WatchGuard Firebox leftover debug code vulnerability
An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command...